Tool and Action Authorization — Securing Agentic AI in the Enterprise

Deterministic allow, deny or escalate at the action boundary, with velocity and blast-radius ceilings that halt.

Minimum bar (L2). Tool availability is enforced outside the model—by the orchestrator or a policy layer—never by instructions in a prompt. Each agent has an explicit, minimal tool allowlist.

10.1 Controls #

ID	Control	Minimum bar (L2)	Enforced state (L3)
TOOL-1	Policy engine at the action boundary	Authorization is evaluated at a single identifiable enforcement point that every tool call traverses, rather than implemented separately per tool or per agent. The verdict may be a static allow or deny against the agent’s declared tool list rather than a contextual evaluation, but no call reaches a side effect without passing through it.	A policy engine that renders allow / deny / escalate per tool call, evaluating the tool, the parameters, the destination, the data classification involved, and the invoking authority.
TOOL-2	Default deny	Tool availability is allowlist-based: an agent may invoke only what its registry entry declares, and adding a tool is a reviewed change. Unknown tools fail closed. Parameter and destination validation may still be implemented per tool rather than centrally policed.	Default DENY for unknown tools, unknown destinations, and unknown parameter shapes.
TOOL-3	Velocity ceilings	Rate limits applied per agent identity—not per user and not per API key—at the orchestrator or gateway, with thresholds derived from observed normal behavior rather than vendor defaults. Breach raises an alert to a monitored queue.	Velocity ceilings: maximum tool calls per unit time, per agent and per agent class, that halt execution rather than alert.
TOOL-4	Blast-radius ceilings	Documented maximums per task for records affected, spend, and distinct systems touched, enforced where the platform supports it and monitored where it does not. Any agent without a declared ceiling is recorded as an exception with a named owner.	Blast-radius ceilings: maximum records affected, maximum spend, maximum distinct systems touched per task, enforced as hard stops.
TOOL-5	Circuit breakers	Retry and failure limits configured at the orchestrator so that a looping or repeatedly denied agent terminates rather than continuing indefinitely. Clustered authorization denials generate an alert, since that pattern is the visible signature of an agent probing a boundary.	Circuit breakers on repeated failures, repeated retries, and anomalous action sequences—the observable signature of an agent searching for a way around a boundary.
TOOL-6	Mutual authentication between agents	Agent-to-agent calls are authenticated rather than trusted by network position or shared orchestrator membership, using the platform’s native mechanism such as mTLS or signed agent cards. Token passthrough—forwarding a token not issued for the receiving party—is prohibited by policy and checked at review.	Mutual authentication between agents; no implicit trust based on network position or shared orchestrator.
TOOL-7	Tamper-evident decision records	Every tool invocation and its authorization outcome is logged to a centralized store outside the agent’s own write scope, with defined retention and restricted access. Immutability may be achieved through destination controls rather than cryptographic sealing.	Immutable, tamper-evident decision records for every authorization verdict, retained independently of the system that produced them.

10.2 Evidence to Request #

Policy engine configuration.
A halt event from production or from a live test.
The tamper-evidence mechanism for decision records.

10.3 Failure Modes #

Guardrails implemented as prompt instructions. A model can be argued out of a prompt; it cannot be argued out of an allowlist.
Ceilings configured to alert rather than halt, which converts a control into a notification and reintroduces the human-speed bottleneck.
Sub-agent invocation treated as internal and therefore exempt from authorization, creating an unpoliced path around every other control.